CVE-2026-9728
- Source
- https://cve.org/CVERecord?id=CVE-2026-9728
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9728.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-9728
- Aliases
-
- GHSA-47q2-w832-7w67
- Published
- 2026-08-24T14:28:46Z
- Modified
- 2026-10-06T07:01:24Z
- Severity
-
- 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L CVSS Calculator
- Summary
- TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory
- Details
-
The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mbox_msg * pointer to z_impl_mbox_send() and the underlying driver. Between the access check and the driver's use of msg->data, the validated pointer could be replaced, leaving a time-of-check/time-of-use window.
On a system built with CONFIG_USERSPACE, any unprivileged userspace thread may invoke the mbox_send() system call. A second thread sharing the caller's address space can race to overwrite msg->data with a supervisor (kernel) address after the verifier's bounds check has passed but before the driver dereferences it. The driver then reads from the attacker-chosen address in supervisor context (for example memcpy(&data32, msg->data, msg->size) in the NXP mailbox driver, whose bytes are subsequently emitted to the peer mailbox endpoint).
The impact is a userspace-to-supervisor access-control bypass: disclosure of kernel memory contents (high confidentiality impact), or, for an invalid/unmapped target address, a faulting kernel read causing denial of service. The fix snapshots the entire struct mbox_msg into a kernel-stack copy with k_usermode_from_copy() and validates and forwards that immutable copy, closing the race.
- Database specific
{ "cna_assigner": "zephyr", "cwe_ids": [ "CWE-367" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9728.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9728.json
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-47q2-w832-7w67
- https://nvd.nist.gov/vuln/detail/CVE-2026-9728
- https://github.com/zephyrproject-rtos/zephyr/commit/ab35eaccec5976f05c196f176d0c32885754496f
- https://github.com/zephyrproject-rtos/zephyr
Affected packages
Git / github.com/zephyrproject-rtos/zephyr
Affected versions
v3.*
v4.*
zephyr-v3.*
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9728.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "78517314794259360227183200728440893573",
"length": 356
},
"id": "CVE-2026-9728-5a08503f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/ab35eaccec5976f05c196f176d0c32885754496f",
"target": {
"file": "drivers/mbox/mbox_handlers.c",
"function": "z_vrfy_mbox_send"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"48515705576277014870705260274146884859",
"30272708634888415703756055476568909417",
"10467468853473895153475323877403802331",
"298860747516236632819268876436740623600",
"233877546415423898461719811669934477499",
"122088841722900251347364245414550966263",
"225778878794975270995344126867722130823",
"74798103472868859033971441157456884466",
"333433743367106105183384230152016745163",
"92686133226536742225501844513463735725"
],
"threshold": 0.9
},
"id": "CVE-2026-9728-b90c29ea",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/zephyrproject-rtos/zephyr/commit/ab35eaccec5976f05c196f176d0c32885754496f",
"target": {
"file": "drivers/mbox/mbox_handlers.c"
}
}
]
vanir_signatures_modified
"2026-10-06T07:01:24Z"